[SSSD] better handling of DNS timeouts

Stephen Gallagher sgallagh at redhat.com
Fri Aug 19 18:17:47 UTC 2011


On Fri, 2011-08-19 at 14:07 -0400, Dmitri Pal wrote:
> I think you are wrong and there use cases when the timeout should be
> different. But I will stop insisting.
> And IMO if the auth can't go without the internal ID lookup is also
> wrong. It should be an option to trust the auth server to do the right
> thing and use id from cache.
> 

This is absolutely wrong. The reason for the forced ID lookup is because
you need to be sure that access-control rules are up-to-date. Those
access-control rules are not available to the auth server in many cases
(one such example is HBAC; consider a firewall issue or DS crash). It's
a security vulnerability to rely on online authentication and cached
access-control rules at the same time.

Other common examples would be classic LDAP/kerberos authentication
using either the simple access provider or pam_access. If the user's
group list has changed since the cache was updated, we could potentially
be granting access where it should now have been removed.

If the identity server is offline, we MUST work only with what we have
in the cache. This means using cached auth instead of online auth. (The
advantage here with Kerberos is that it means they aren't being granted
a TGT either).
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.fedorahosted.org/pipermail/sssd-devel/attachments/20110819/6e66864e/attachment.sig>


More information about the sssd-devel mailing list